Hospital not liable for employee’s disclosure of PHI

A patient could not recover from a hospital on a theory of vicarious liability after a hospital employee divulged the patient’s test results to the patient’s sister during a casual conversation at a local bar. The Illinois Supreme Court unanimously rejected the patient’s claims against the hospital because the employee was acting outside the scope of her employment when she disclosed the patient’s confidential information.

While filing test results at the hospital, the employee saw the results of the patient’s blood test, which indicated that she was pregnant. The employee later revealed the pregnancy to the patient’s sister, who had not previously known of it. The patient’s lawsuit followed, raising various privacy claims against the employee and the hospital. The claims against the hospital were based on the theory that the hospital was vicariously liable for the actions of its employee.

Scope of employment

Although the court recognized that the employee had a continuing duty to maintain patient confidentiality, it found that the other two criteria used to determine the liability of an employer for the conduct of its employee were absent from the case. First, citing to the hospital’s Health Insurance Portability and Accountability Act training program, confidentiality policy, and code of conduct, the court determined that the employee’s disclosure of the patient’s test results was not the kind of conduct she was employed to perform. Second, emphasizing that the disclosure was in direct contravention of the hospital’s confidentiality policy, the court found that the employee’s conduct was in no way motivated by a purpose to serve the hospital. The court concluded, “[T]he only reasonable inference from the undisputed facts is that [the employee’s] motivation was solely and exclusively personal and not related to her position as an employee of [the hospital].”

{Here is a very disturbing legal outcome—a hospital employee saw a positive pregnancy test result as a result of her access to the patient’s test results and told the patient’s sister. Instead of the hospital being liable for this clear violation of privacy by their employee, the court somehow found that the hospital was not liable for the employee’s bad actions. ~ Dr. Deborah Peel, Patient Privacy Rights}